CVE-2024-4463 Squelch Tabs and Accordions Shortcodes <= 0.4.7 - Cross-Site Request Forgery

The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.7. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to modify...

CVE-2024-4463

CVE-2024-4463 affects the Squelch Tabs and Accordions Shortcodes WordPress plugin. The issue is a Cross-Site Request Forgery (CSRF) due to missing/incorrect nonce validation when saving plugin settings, allowing unauthenticated attackers to modify settings by tricking a site administrator into pe...

CVE-2024-3070

CVE-2024-3070 affects the WordPress plugin Last Viewed Posts by WPBeginner (vulnerable up to 1.0.0). It allows unauthenticated PHP Object Injection via deserialization of the LastViewedPosts cookie. The vendor notes no known POP chain publicly; however, if a POP chain exists via another plugin or...

CVE-2024-4082

CVE-2024-4082 : The Joli FAQ SEO – WordPress FAQ Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 1.3.2 due to missing nonce validation when saving settings. This enables unauthenticated attackers to change plugin settings by inducing an administrator action....

CVE-2024-4082 Joli FAQ SEO – WordPress FAQ Plugin <= 1.3.2 - Cross-Site Request Forgery

The Joli FAQ SEO – WordPress FAQ Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the...

CVE-2024-3806

CVE-2024-3806 concerns the Porto theme for WordPress. It enables Unauthenticated Local File Inclusion via porto_ajax_posts in all versions up to 7.1.0, allowing arbitrary PHP code execution by including server files. Impact includes bypassing access controls and potential data exposure or code ex...

CVE-2024-1230

Technical details about CVE-2024-1230 are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2024-4103 ADFO – Custom data in admin dashboard <= 1.9.0 - Cross-Site Request Forgery

The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on several functions hooked via the controller function. This makes it possible for...

CVE-2024-4103 ADFO – Custom data in admin dashboard <= 1.9.0 - Cross-Site Request Forgery

The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on several functions hooked via the controller function. This makes it possible for...

CVE-2024-4103

CVE-2024-4103 affects ADFO – Custom data in admin dashboard for WordPress. It is a CSRF vulnerability in all versions up to 1.9.0 caused by missing/incorrect nonce validation on functions hooked via the controller() function, enabling unauthenticated attackers to edit plugin settings if a site ad...

CVE-2024-4441

CVE-2024-4441 affects the WordPress plugin XML Sitemap & Google News. The vulnerability is Local File Inclusion via the feed parameter in all versions up to 5.4.8, allowing unauthenticated attackers to include and execute arbitrary server-side files (PHP) and potentially bypass access controls or...

CVE-2024-3915

CVE-2024-3915 affects the Swift Framework WordPress plugin (versions up to and including 2.7.31). The root cause is a missing capability check in sf_edit_directory_item(), enabling unauthenticated attackers to modify arbitrary posts/content. Impact per available data is limited to integrity (LOW)...

CVE-2024-4314 hostel <= 1.1.5.3 - Cross-Site Request Forgery

The Hostel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5.3. This is due to missing or incorrect nonce validation when managing rooms. This makes it possible for unauthenticated attackers to create and delete rooms via a forged request...

CVE-2024-4314

CVE-2024-4314 affects the Hostel WordPress plugin up through version 1.1.5.3, where CSRF exists due to missing/incorrect nonce validation in room management. This allows unauthenticated attackers to trigger actions (e.g., create or delete rooms) by enticing an admin to click a crafted link. The C...

CVE-2024-4041 Yoast SEO <= 22.5 - Reflected Cross-Site Scripting

The Yoast SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 22.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-4150

The CVE-2024-4150 issue affects the WordPress plugin Simple Basic Contact Form, up to version 20221201. It enables Reflected Cross-Site Scripting via the scf_email parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject scripts in pages e...

White Label CMS < 2.7.4 - Missing Authorization to Plugin Settings Reset

Description The White Label CMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the resetplugin function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to reset plugin settings...

EWWW Image Optimizer < 7.3.0 - Cross-Site Request Forgery

Description The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.3. This is due to missing or incorrect nonce validation on the checkforoptin and checkforoptout functions. This makes it possible for unauthenticated...

CVE-2024-4135 WP Latest Posts <= 5.0.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin allowing users to execute an action that does not properly validate a user-supplied value prior to using that value in a call to...

CVE-2024-4393

The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to lo...